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Abstract —The problem of sending a secret message over 
the Gaussian multiple-input multiple-output (MIMO) wiretap 
channel is studied. While the capacity of this channel is known, it 
is not clear how to construct optimal coding schemes that achieve 
this capacity. In this work, we use linear operations along with 
successive interference cancellation to attain effective parallel 
single-antenna wiretap channels. By using independent scalar 
Gaussian wiretap codebooks over the resulting parallel channels, 
the capacity of the MIMO wiretap channel is achieved. The 
derivation of the schemes is based upon joint triangularization of 
the channel matrices. We find that the same technique can be used 
to re-derive capacity expressions for the MIMO wiretap channel 
in a way that is simple and closely connected to a transmission 
scheme. This technique allows to extend the previously proven 
strong security for scalar Gaussian channels to the MIMO case. 
We further consider the problem of transmitting confidential 
messages over a two-user broadcast MIMO channel. For that 
problem, we find that derivation of both the capacity and a 
transmission scheme is a direct corollary of the proposed analysis 
for the MIMO wiretap channel. 

Index Terms —Wiretap channel, MIMO channel, confidential 
broadcast, successive interference cancellation, dirty-paper cod¬ 
ing, matrix decomposition. 


I. Introduction 

The wiretap channel, introduced by Wyner m, is composed 
of a sender (“Alice”) who wishes to convey data to a legitimate 
user (“Bob”), such that the eavesdropper (“Eve”) cannot 
recover (almost) any information of these data. The capacity of 
this channel 12, E equals to a mutual-information difference, 
and was extended to the Gaussian case in 0- Let the channels 
from Alice to Bob and Eve be given by 

Vb = h B x + z B , 
y E = h E x + z E , 


multiple-input multiple-output multiple-eavesdropper (MI- 
MOME) channel ®-|2, is given by 

y B = H B x + z B , (2a) 

y E =H E x + z E , (2b) 

where x, y B and y E are complex-valued vectors with dimen¬ 
sions of the number of antennas in the terminals of Alice, 
Bob and Eve, denoted by Na, N b , and N E , respectively. The 
channel matrices Hb and 11 E have the corresponding dimen¬ 
sions. The additive noise vectors z B and z E are mutually 
independent, i.i.d., circularly-symmetric Gaussian with zero 
mean unit element variance. 

The secrecy capacity of this scenario for the case where the 
input is subject to an average covariance constrain {] 

K = E [W] A K, (3) 

and the case where the input is subject to a total (over all 
antennas) power constraint P: 

trace(K) < P, 

was established in 0 and 12-12, respectively. Under a 
covariance constraint, this capacity is given by the difference 
of mutual informations to Bob and Eve, optimized over 
all Gaussian channel inputs that satisfy the respective input 
constraint: 

C s (H B ,H B ,K) = max/ s (H B ,H E ,K), (4) 

KXK 

where 

/ S (H B ,H C ,K) ^/(H B ,K)-/(H B ,K), (5) 

and 

J(H,K) = logll + HKH+l (6) 


where h B and h E are complex scalar gains, z B and z E 
are mutually-independent circularly-symmetric Gaussian zero 
mean unit variance noises and the transmission is subject to 
a unit power constraint. Then, the capacity is achieved by a 
Gaussian input: 


Cs(h B , h E ) = I (x; y B ) - I (x; y E ) 


log (l + |(i B | 2 ) - l°g (i + \h E \ 2 ) , 


(la) 
, (lb) 


where [a]+ = max{0, a} is the positive-part operation. 

The vector extension of this result, the multiple-input 
multiple-output (MIMO) Gaussian wiretap channel or the 
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is the Gaussian vector mutual information (MI), and |A| 
denotes the determinant of A. Later, Bustin et al. JT] provided 
an explicit solution to the maximization problem under the 
covariance constraint 0. A closed-form solution for the 
wiretap capacity under a total power constraint is yet to be 
found, although a numerical algorithm that approaches the 
global optimum was recently proposed (8). We note that the 
capacity under a total power constraint can be written as 
the union of achievable regions under a covariance constraint 
(see []9] Lemma 1]): 

C S (H B ,H B ,P) = max C s ( H B ,H B ,K). (7) 

K: trace{K}=P 

Hence, we shall concentrate on the covariance constrained 
setting in this paper. 

'A y 0 denotes that A is a positive semidefinite matrix. A A B means 

that (A - B) ^ 0. 




2 


The confidential broadcast channel offers a natural extension 
to the wiretap channel setting. In the confidential broadcast 
setting, Alice wishes to convey different data to two users 
(“Bob” and “Charlie”), such that (almost) no information can 
be recovered by one user about the data intended for the other 
user. That is, for the data that are intended for Bob, Charlie acts 
as the eavesdropper (“Eve” in the wiretap setting), whereas for 
the data intended for Charlie, Bob takes the role of Eve. 

The capacity region of the Gaussian MIMO confidential 
broadcast channel, a scenario considered first in lUOl . was 
determined by Liu et al. CD to be rectangular under the 
covariance constraint ©. Namely, it is given by all rate pairs 
{R B ,R C ) satisfying 

i?B<C s (H B ,H c ,K), (8a) 

Rc<C s { H c ,H b ,K), (8b) 

where He is the channel matrix to Charlie replacing 11 / 
in (l2bl >, and C's(H B , lie - K) is the capacity of the MIMO 
wiretap channel defined in (0). The converse is immediate, 
as both users achieve their maximal possible secrecy rates 
simultaneously; it is the direct part that is quite striking. 

Although capacity is well understood, it is less clear how to 
construct codes for wiretap and confidential broadcast chan¬ 
nels. For the scalar Gaussian case, various approaches have 
been suggested, see, e.g., m-m and references therein. 
However, assuming that we have such a code for the scalar 
case, it is not clear how to construct a capacity-achieving 
scheme for the MIMO setting. 

In this work we present an approach that reduces these 
MIMO secrecy problems to scalar Gaussian ones by means 
of matrix decompositions, specifically joint unitary triangu- 
larizations m. The decompositions yield a layered coding 
scheme, where the secrecy capacity is approached by means 
of a scalar wiretap code in each layer and successive inter¬ 
ference cancellation (SIC) at the receiver. The contribution 
of such an approach to the MIMO wiretap channel can be 
compared to that of singular-value decomposition (SVD) based 
schemes fl20l . or Vertical Bell-Laboratories Space-Time (V- 
BLAST) and decision feedback equalization (GDFE) schemes 
ED-El, to MIMO communication without secrecy con¬ 
straints. 

Beyond the architectural merit, our approach yields two 
more fruits. First, it enables us to revisit the capacity results 
for the MIMO wiretap and confidential MIMO broadcast 
channels. In that respect, we establish the optimal covariance 
matrix for the MIMO wiretap channel as well as an expression 
for the secrecy capacity in terms of the generalized singular 
values of suitably defined matrices. This re-derives a result by 
Bustin et al. 0, which was based on elaborate information- 
theoretic considerations, using a direct linear-algebraic ap¬ 
proach. Turning to the confidential broadcast channel, we are 
able to re-derive © almost as a corollary of the analysis 
applied to the MIMO wiretap channel, also explaining the role 
of dirty-paper coding in this setup. 

Second, reducing the MIMO problem to a scalar one allows 
us to leverage recent advances in the secrecy analysis of 
the scalar Gaussian wiretap channel: whereas we concentrate 


in this paper on constructing weak secrecy schemes, namely 
schemes for which 

I (x n \y B ) <ne, (9) 

we show that in fact a special matrix triangularization allows 
to achieve strong secrecy guarantees for the MIMO wiretap 
channel, i.e., 

I(x n ;y n B )<e, (10) 

where both © and ( ITOt hold for any e > 0 and large enough 
blocklength n. 

An outline of this paper is as follows. We start by reviewing 
the relevant unitary matrix decompositions in Section 01] 
These decompositions are used to re-derive the MIMO wiretap 
capacity expressions in Section 0111 We further recall how these 
decompositions allow to construct capacity-achieving schemes 
for the MIMO channel without secrecy in Section 0V] We 
extend this framework to work for the MIMO wiretap setting 
in Section [V] Layered dirty-paper coding (DPC) ||25l variants 
of this scheme are discussed in Section [VI] and are also shown 
to be capacity achieving. Finally, these schemes are utilized, 
along with the results of Section|III] to construct a simple proof 
of the capacity region of the confidential MIMO broadcast 
setting as well as providing a layered-DPC scheme that attains 
it in Section [VTII 

II. Unitary Matrix Triangularization 

In this section we briefly review some important matrix de¬ 
compositions which will be used in the sequel. In Section ITl-AI 
we recall the generalized triangular decomposition (GTD), 
and some of its important special cases which include the 
SVD, OR decomposition, and geometric mean decomposition 
(GMD)f| loint unitary triangularizations of two matrices are 
discussed in Section Hl-BI 

Throughout this paper, we shall only need to decompose 
full-rank matrices with equal or more rows than columns. 

A. Single Matrix Triangularization 

The following definitions are used in this section. 

Definition 1 (Multiplicative majorization; see I27U . Let x 
and y be two ^/-dimensional vectors of positive elements. 
Denote by x and y the vectors composed of the entries of x 
and y, respectively, ordered non-increasingly. We say that x 
majorizes y {x > y) if they have equal products: 

N N 

n x :i =n yj > 

3 =1 3 =1 

and their (ordered) elements satisfy, for any 1 < £ < N, 

i l 

II i: :i - n Vi 

3 =1 3=1 

Definition 2 (Singular values; see l28l ). Let A be a full-rank 
matrix of dimensions M x N, where M > N. Then, the 

2 See (26) for a geometrical interpretation of these decompositions. 
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singular values (SVs) of A are the positive solutions a of the 
equation 

I A f A — cr 2 l| =0. 

Let the SV vector <x(A) be composed of all SVs (including 
their algebraic multiplicity), ordered non-increasingly. 

The following is a straightforward extension of the defini¬ 
tion of triangular matrices to non-square ones. 

Definition 3 (Generalized Upper-Triangular Matrix). An 
M x N matrix is said to be generalized upper triangular if 

Ti,j = 0, Vz > j ; z = l,...,M; j = l,...,N. 


B. Joint Matrix Triangularization 

The existence condition for a joint unitary triangularization 
of two matrices is similar to that of the GTD in Theorem [T] 
where the singular values are replaced by the generalized 
singular values (GSVs), and the diagonal of T is replaced by 
the ratio of the diagonals of the resulting generalized triangular 
matrices. These quantities are defined below. 

Definition 4 (Generalized singular values [28], |36l ). For any 
(ordered) matrix pair (Ai, A 2 ), the GSVs are the non-negative 
solutions fj, of the equation 


AjA, 


p 2 a\a 2 


= 0 . 


We use these definitions to characterize the set of all 
possible diagonals achievable via unitary triangularization, as 
follows. 

Theorem 1 (Generalized Triangular Decomposition). Let A 
be a full-rank matrix of dimensions M X N, where M > N, 
and t be an N-dimensional vector of positive elements. A GTD 
of the matrix A is given by 

A = UT V f , (11) 

where U andY are unitary matrices of dimensions M x M and 
N x N, respectively, and T is a generalized upper-triangular 
matrix with a prescribed set of diagonal values t, i.e., 

Tu = U , i = l,...,N, 

Tij = 0, Vz > j . 

Such a decomposition exists if and only if the vector t is 
majorized by <r(A): 

tr(A) y t. 

In other words, the singular values are an extremal case for 
the diagonal of all possible unitary triangularizations. 

The necessity of the majorization condition was proven by 
Weyl [29| . Horn further showed that for any r that is majorized 
by er, there exists an upper triangular matrix with diagonal r 
and SV vector <x ]30l . The sufficiency of the majorization 
condition as it appears in Theorem[T|was proved in 1371 -1331, 
where also explicit constructions of the decomposition were 
introduced. 

We now recall three important special cases of the GTD. 

1) SVD (See, e.g., 051/): Here the resulting matrix T in 
( ITU is a diagonal matrix, and its diagonal elements are equal 
to the singular values of the decomposed matrix A. 

2) QR Decomposition (See, e.g., 051/): In this decompo¬ 
sition, the matrix V in (flTT i equals to the identity matrix and 
hence does not depend on the matrix A. This decomposition 
can be constructed by performing Gram-Schmidt orthonor¬ 
malization on the (ordered) columns of the matrix A. 

3) GMD (See 07V . 071/ . 051/ ): The diagonal elements of 
T in this decomposition are all equal to the geometric mean 
of its singular values er(A), which is real and positive. Note 
that this decomposition always exists if A is full rank (since 
the vector of the SVs of A necessarily majorizes the vector 
of the diagonal elements of T), but is not unique. 


Let the GSV vector p(Ai, A 2 ) be composed of all GSVs (in¬ 
cluding their algebraic multiplicity), ordered non-increasingly. 

A characterization of the possible joint unitary triangular¬ 
izations of two matrices with prescribed diagonal ratios is 
provided in the following theorem. 

Theorem 2 (Joint unitary triangularization ffT9l ). Let Ai and 
A 2 be two full-rank matrices of dimensions Mi X N and 
M 2 x N, respectively, where M \, M 2 > N, and t be an 
N-dimensional vector of positive elements. A joint unitary 
triangularization of the matrices Ai and A 2 is given by 

Ai = U 1 T 1 V t , (12a) 

A 2 =U 2 T 2 V t , (12b) 


where Ui, U 2 and V are unitary matrices of dimensions 
Mi x Mi, M 2 x M 2 and N x N, respectively, and Ti and T 2 
are generalized upper-triangular matrices (recall Definition 0 
with a prescribed set of diagonal ratios t, i.e., 


Ti-a 


— ti ■ 


T 2 -u 
Tk'i,j = 0, 


k = 1 , 2 . 


Vz > j. 


Such a joint decomposition exists if and only if the vector t is 
majorized by the GSV vector p( Ai, A 2 ): 

p(Ai,A 2 )ht. (13) 


In other words, the GSVs are an extremal case for the 
diagonal ratios of all possible joint unitary triangularizations. 
The joint unitary decomposition that corresponds to these 
extremal values is the GSVD. 

Following the exposition in [37] , li38l . we next review the 
two forms of the GSVD — diagonal and triangular. The 
diagonal representation of the GSVD is better known. For a 
matrix pair (Ai, A 2 ) it is given by [28] , [36l : 

Ai = UiDiXt, (14a) 

A 2 =U 2 D 2 X t , (14b) 


where Ui and U 2 are unitary, X is invertible, and Di and D 2 
are generalized diagonal matrices (viz., Dk-i,j = 0 for i f j, 
where Dk-yj is the (z, j) entry of Dk) with positive diagonal 
values satisfying: 

D{Di + dJ,D 2 = I, (15) 
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the ratios of which are equal to the GSVs: 

= Mi (Ai, A 2 ), i = l,...,N, 

and are assumed, w.l.o.g., to be ordered non-increasingly. 
To obtain the triangular form of the GSVD, apply a QL 
decomposition to X, to attain: 

Ai =UiDiTV t 

— UtTrV^, (16a) 

A 2 = U 2 D 2 TV t 

= V 2 T 2 Y\ (16b) 

where T is upper triangular and V is unitary. By denoting 
Ti = DiT and T 2 = D 2 T, we attain the triangular form of 
the GSVD, which is, in turn, a special case of (flZb . 

III. The MIMO Wiretap Capacity Revisited 

In this section we re-derive the explicit capacity expression 
of Bustin et al. m for the MIMO wiretap channel under 
a covariance constraint © in terms of the GSVD. While 
we do not establish a new capacity result, our approach of 
simultaneous unitary triangularization will lead to a simplified 
representation of the optimal covariance matrix as well as 
layered coding schemes, as will be discussed in the subsequent 
sections. 

The following augmented matrix structure, which serves 
as the MIMO channel analogue of the minimum mean 
square error (MMSE) variant of decision feedback equalization 
for linear time-invariant systems (39], will be instrumental 
throughout this work. 

Definition 5 (Effective MMSE channel matrix). Let H be a 
channel matrix of dimensions iV B x N A and let K be the 
Na x N A input covariance matrix used over this channel. 
Then, the corresponding effective MMSE channel matrix is 
the (Na + Nb ) x Na matrix 

G(H.K)4(HK 1/J ), (17) 

where I is the identity matrix of dimension Na and K !/ 2 is 
any matrix B satisfying BB^ = K0 

This definition naturally lends itself to an MMSE (capacity- 
achieving) variant of the V-BLAST/GDFE scheme (24], as will 
be described in Section [TV] See also |40l , lfl9l . (261 for further 
explanations. 

Construct the effective MMSE matrices = G(H B ,K) 
and Gg = G(H B , K), where K is subject to the constraining 
matrix K ©: K X K. 

Now, apply some joint unitary triangularization (fTTV 

G B =U B T B V^, (18a) 

Ge = U B T B V^ , (18b) 


where U B , U B and \ A are unitary, and T B and T ^ are 
generalized upper triangular (recall Definition©. 

Let { h t } and {e,;} denote the diagonal values of T B and 
T e, respectively, where, as explained in Section III-BI these 
values can be designed by varying V^. Using the fact that the 
absolute value of a determinant of a unitary matrix is equal 
to 1, and the fact that the determinant of a triangular matrix is 
equal to the product of its diagonal values, the Gaussian MI 
© can be expressed as: 

/(H S ,K) =log|G^G s 

and similarly for Eve: 

/(H B ,K) = log|G^G B 
= ^iog el 

Hence, their difference © is given by 

Na b 2 

Is( H B ,H B ,K) =^log^. 

*= 1 6i 

Note that the expression in (l20l) holds for any unitary matrix 
V A in m . Indeed, as we shall see later, this flexibility in 
choosing can lead to different design tradeoffs in our 
layered coding schemes. Nevertheless, to derive an explicit 
capacity expression we specialize to be the right unitary 
matrix of the GSVD ( IT6l ). until the end of the section. The 
corresponding GSVs are hence equal to 

IM (H B) H b ,K) ±ih (G b ,G b ) 

- h 

ei ’ 

where we use the notation p.i (H B ,H B ,K) to emphasize the 
dependence in K. Without loss of generality, we assume that 
the GSV vector is non-increasing. 

In terms of the GSVs, we can rewrite © as: 

N a 

Cs (H b , H b , K) = max ]T log /i 2 (H B , H B , K). 

i—l 

Indeed, in these terms the MIMO wiretap capacity can be 
expressed as follows. 

Theorem 3 (MIMO wiretap capacity under a covariance con¬ 
straint 0). The secrecy capacity under a covariance matrix 
constraint K is given by 

Na 

C s (H b ,H b ,K) = ^ [log/x 2 (H b ,H b ,K)] + (21a) 
2=1 
Lb 

= ^2 log (H s , H b , K) . (21b) 

2=1 


(19a) 

(19b) 


3 This decomposition is similar to the QR decomposition, only instead of 
an upper-triangular matrix, the resulting matrix is lower triangular. This can 
be achieved, e.g., by applying Gram-Schmidt triangularization to the columns 
of a matrix, from last to first. 

4 Such a B can always be constructed, e.g., using the Cholesky decompo¬ 
sition or unitary diagonalization. 


This explicit capacity expression along with the optimal 
covariance matrix K d K were established by Bustin et al. 0 
using the channel enhancement technique along with vector 
extensions of the mutual information-minimum mean-square 
error (I-MMSE) relation. We present an alternative proof of 
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this result using a direct approach: once the optimization 
problem 0 is stated, it can be solved by linear algebra and 
elementary calculus only. The key to our proof is the following 
lemma. 

Lemma 1. Let K and K be two matrices satisfying 
0 A K A K. Then for all i = 1,..., Na, 

| log Mi (Hb , He , K) | > |log^(H B ,H B ,K)|. 

That is, as we “decrease” the input covariance, the GSVs 
move towards //,; = 1. The proof, which appears in Ap¬ 
pendix [A] uses standard matrix calculus to show that the 
differential of the *-th GSV, d/i,, with respect to a change 
in the covariance matrix cZK, is given by 

dfM = -l) '7i(dK), 

where yi(dK) > 0 for dK A 0. Or to put it differently, dpi > 0 
for > 1, and dfi { < 0 for < 1. 

By Lemma Q] clearly Theorem [3] gives an upper bound on 
the capacity. To see that it is achievable, consider the matrix: 

K = K 1/2 V A I B V^K 1/2t , (22) 


where V A is the right unitary matrix of the triangular form 
of the GSVD d). \ B is a diagonal matrix whose first Lb 
diagonal values (corresponding to GSVs that are greater than 
1) are equal to 1, and the remaining L B — to 0. Trivially, 
K A K. The choice of K effectively truncates the GSVs of K: 


log di (Hb,Ho,K) = [log/*? (H B ,Hc,K)] + . 

This is formally proved in Appendix [B] 

Remark 1. The optimal covariance matrix K (l22l) is denoted 
by K* in Q, where it is given in terms of the diagonal form 
of the GSVD dl 


i* 

<N 

II 

(Y^Y b) 1 

^ Lb X-Le 


^LexLb 

0 LexLe. 


Y t K t/2 , (24) 


where Y = X ' and X is the right invertible matrix of ( 1 1 4k 
Y B is the sub-matrix composed of the first L B columns of Y, 
and 0 m xn denotes the all-zero matrix of dimensions m x n. 
Comparing (l22l> and (124b . it is evident that using the triangular 
form of the GSVD indeed simplifies the representation over 
using the diagonal one. 

Remark 2. One may wonder why, of all possible choices of 
V A , the capacity is given in terms of the GSVD. An intuitive 
reason is as follows. By the majorization condition ( fl3l ). the 
GSV vector is extremal among all possible diagonals. In 
particular, for any V A , 


Na 


N a 




log ? 


i J + 


Thus, the sum (12 lab is larger than the sum over diagonal ratios 
induced by other triangular decompositions. 


s In J7] a specific choice of K 1 / 2 was used: the matrix B that satisfies 

BB = K. 


Remark 3. Using 0, the capacity of the MIMO wiretap 
channel under a power constraint P can be written as 

Na 

C s (H b ,H c ,P) = max V [log**? (H S ,H C ,K)] 

K:trace{K}=P z — ' 

i— 1 

Remark 4. For the optimal K d22l . all the GSVs are greater 
or equal to 1. To the contrary, assume that some are strictly 
smaller than 1; then, we can use a matrix K with the 
appropriate directions “nullified”. Such a “truncated” matrix 
will satisfy the covariance constraint while improving the 
achievable secrecy rate of the scheme, in contradiction to 
the assumption. A fortiori, under a power constraint, the 
power saved by such a truncation can be allocated to “useful” 
directions. 

IV. Scalar Transmission over MIMO Channels 
I n this section we briefly review the connection between ma¬ 
trix decompositions and scalar transmission schemes, without 
secrecy requirements. For a more thorough account, the reader 
is referred to {191, l26l . l40l - 

In this work we shall assume all the scalar codes to be 
Gaussian, as defined next. 

Definition 6 (Gaussian codebook). A Gaussian codebook 
of length n, rate R and power P — e, where e > 0, 
consists of \2 nR ~\ codewords of length n, denoted by 
x n (1) ,x n (2),... ,x n ([2"*]). The entries of all the code¬ 
words, {xt(i)\t = 1 = 1,..., |~2 rljR ] }, are i.i.d. 

with respect to a Gaussian distribution with zero mean and 
variance P — e. 

Remark 5. In the sequel, with a slight abuse of notation, we 
shall refer to such codes as Gaussian codes of power P (where 
e will serve as an implicit design parameter). 

Consider the channel (f2al) . Construct the effective MMSE 
matrix G B = G(H B ,K) as in Definition 0 and choose some 
unitary matrix V A . 

Apply the GTD (fTTb to G/j with V A as the right matrix: 

G b = U S T S V^. (25) 

Now let x be a vector of standard Gaussian variables, and set 

x = K 1/2 V A i . (26) 

Denote by U B the N B x 7V A upper-left sub-matrix of U B , and 
define 

T fl = U b H b K 1/,2 V a . (27) 

The following lemma, whose proof can be found in ll24l . 
[40.!, Lemma III.3], 1 411 Appendix I], provides the connection 
between the elements of T B and T/>. 

Lemma 2. Denote by [T B ] the Na x Na upper-triangular 
sub-matrix composed of the first Na rows of T B (125b FI Then, 
T b <[27j is equal to 

Ts = [Tb] - [Tb]- + - 

6 Since T# is full rank, [Tb] is full rank too, and hence also invertible. 
Further, its diagonal elements are greater or equal to 1 due to the block I in 
the construction of Gb- 
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In particular, 




Tb-i,] — 1 /TB\i,j i = j 


(28) 


where Ts-ij and Tb-,ij are the ( i,j ) entries of the matrices 
T b and T b, respectively. 


Let 


Vb ~ U bVb 
- T t 


= \J' b H b K 1/2 Va£ 
= T B & + z B ■ 


■ U b z b 


(29a) 

(29b) 

(29c) 


vt 


Since U B is not unitary, the statistics of z B = U b z b differ 
from those of zb, and its covariance matrix is given by 


K, 


U B U B . Now, for * = Na, define [recall (l28l) l 


Na 


E~? 

w 

1 

af 

II 

-af 

a 

(30a) 

£=i+l 


i — 1 


— “1“ ^ ^ T]3\i)£X£ H - %B;i 

(30b) 

t=\ 


A rji ~ | eff 

— -L B;i,iXi i "> 

(30c) 


ZB-i and z c /l 7 are the i-th entries of the vectors z B and z e g, 
respectively, and = Y^p=i Ts-.ijXe + z B -i is the resulting 
total effective noise vector. 

In this scalar channel from Xi to y B . B resulting after the 
subtraction of the previously recovered symbols {xc\I > i }, 
we view the remaining symbols \xi\I < i } as “interference”, 
ZB;i — as “noise”, and their sum z B T ( — as “effective noise”. 
The resulting signal-to-interference-and-noise ratio (SINR) is 
given by: 

SINR B;i 4 

K Z‘g;i,i 

A_ _ (■) 2 _ 

K z B -i,i + E C) 2 
1=1 

where K^b.^j and K ZB . i ^ denote the (i, j) entries of K^ b 
and K Z ea, respectively. The following key result achieves the 
mutual information ll24) . |40l Lemma III.3], [41] Appendix I] 
and is based on Lemma l2l 7 l 


I 


®l+l) 


= I (xi;y' B -i) 

= log(l + SINR B;i ) 

= log (pi) , 


(31a) 

(31b) 

(31c) 


where {6^} are the diagonal values of T B ( 1251 ) [mind the 
difference from the diagonal values of T B d28l >l. which satisfy 


6 2 = 1 + SINR S;i (32) 



(a) Transmitter 



(b) Receiver 


Fig. 1: Layered-SIC scheme. Xi denotes the decoded symbol 
xc at the receiver. 


and 

Na N a 

^ ( & i) = H I 0 ® (1 + SINR B;i ) 

i=1 i =1 

= J(H b ,K), 

which equals the channel capacity for the optimal K. 

The analysis above immediately gives rise to the following 
scheme, depicted also in Fig. [7] which is, in turn, a variant of 
the renowned V-BLAST/GDFE scheme ll2TI - ll24l . 

Scheme (Layered-SIC). 

Offline: 

• Select an admissible Na x Na input covariance matrix 
K that satisfies the input constraint]]] 

• Construct the effective MMSE matrix ( fI7] >: G B = 
G(H b ,K). 

• Select a unitary triangularization ([Ill and apply it to the 
matrix Gb, as in (l25l >. to obtain the unitary matrices Us 
and Va, and the generalized upper-triangular matrix T B . 

• Denote the Na diagonal elements of T B by {&,;}. 

• Denote by U B the 1V B x Na upper-left sub-matrix of U B , 
and construct the corresponding matrix T B according to 
@3: T B = U b H b K 1/2 V^. 


7 Note that, even though zb has dependent components, the entries of the 
effective noise z e g, are independent. 


8 More generally, any number N > rank{K} of scalar codebooks can be 
used; see do), G3 for details. 
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zb-i 



Alice Eve 

(a) Full scheme and channel 

Ze-1 Zb-1 



(b) Equivalent channel to Eve. ze-i, ■ ■ ■, ZE;N at 6 independent unit (c) Equivalent channel to Bob assuming correct past decision at the SIC decoder 
power AWGNs. (which is achieved for a large enough blocklength n). 


Fig. 2: Layered-SIC scheme for the MIMO wiretap channel. We assume here N = Na = N B = Ne, for ease of presentation. 


• Construct Na scalar Gaussian codes of length n and unit 
power that are good for SNRs {6? — 1}, i.e., codes of rates 
close to 

{Ri\Ri = log (bj) , i S {1,.. •, W A }} . (33) 

Alice: At each time instant t = 1 ,,n: 

• Forms the vector x of length Na, by taking one sample 
from each codebook. 

• Attains the vector x by multiplying x by \ a and K 1 / 2 : 

x = K 1/2 V A x. (34) 

• Transmits x. 

Bob: 

• At each time instant t = 1,,n, receives y B and forms 
y B according to ( l29l ): 

Vb = ^bVb 
= t B X + Z B . 

• Decodes the n-length codewords using SIC, from last 
(i = Na) to first (i = 1): Assuming correct decoding of 
all codebooks i + 1,..., Na, Bob forms (l30l) : 

t rji ~ i eff 

and recovers Xi. 


By the analysis above, the scheme is optimal in the sense 
that the sum of codebook rates can approach the channel 
capacity. 

Remark 6. The SIC procedure and the performance analysis 
of the scheme implicitly assume that the yet-undecoded code¬ 
books can be considered as AWGN, and consequently that 
each codebook should be capacity achieving for an AWGN 
channel. This is indeed true for Gaussian codes (recall Defi¬ 
nition El but not for any single-user scalar capacity-achieving 
codes as is discussed in Section IVIIII 

V. Multi-Stream Schemes for the 
MIMO Wiretap Channel 

Equipped with the results presented in the previous sec¬ 
tions, we describe how to construct multi-stream schemes that 
achieve the capacity of the MIMO wiretap channel. 

We first describe a scheme in which the channel to Eve 
is effectively diagonalized, in Section IV-AI This particular 
choice facilitates the proof of both weak and strong secrecy 
guarantees over this channel. We then extend this result in 
Section IV-BI by proving that any joint triangularization (fl2l > 
can be used to construct a multi-stream capacity-achieving 
scheme. 

A. Orthogonalizing Eve’s Channel 

We now present a simple adaptation of the layered-SIC 
scheme of Section [IV] to the MIMO wiretap setting, depicted 


































































also in Fig. [2] that achieves the secrecy capacity of the channel 
using scalar wiretap codes. 

To this end, we note that the layered-SIC scheme is 
capacity-achieving (without secrecy constraints) for any choice 
of Va in (l25l >. In particular, we can choose this matrix to be 
the unitary matrix that diagonalizes Eve’s effective channel 
matrix, namely, the right matrix of the SVD of Eve, denoted 
by Va: 

HbK 1 / 2 = . (35) 

Applying this Va to 11 /.; (followed by K 1 1 ) provides effective 
parallel scalar independent channels to Eve, of SNRs {d 2 }, 
where {df} are the diagonal values of De, which constitute 
the singular values of H#K 1//2 . 

The following simple lemma summarizes the connection 
between the SVDs of the effective channel matrix (l35l > and 
the effective MMSE channel matrix Gb(He,K). 

Lemma 3 (Connection to effective MMSE matrix). The SVD 
of the effective MMSE matrix = G(Hg,K) (recall 

Definition [5]) is given by 

G b =U b D e Ya, (36) 

where is a generalized diagonal matrix (viz., De-,ij = 0 
for i ^ j); denote its diagonal elements by {e^}. 

The SVD of Ge <1361 is connected to the SVD of H /.;K 1 1 
(135b as follows. Define di = 0 for i > Na, and note that 
e,; = 1 for i > Na- Define further Ae as the generalized 
diagonal matrix of dimensions Ne x Na whose diagonal is 
equal to ..., ^j, where r = min{(VA, Ne}- Then, 

1) Va = Va, t.e., G e and H^K 1 ^ 2 are diagonalized by the 
same right matrix. 

2) 1 + df = ef , i = 1 ,..., Na- 

3) \Je = VIeAe, where U e is the Ne x Na upper-left sub¬ 
matrix of \Je- 

The respective decomposition of G^ is as in ( 125 b . where the 
diagonal values of the resulting generalized triangular matrix 
T s are {bi}. 

Since Eve observes parallel independent channels, using 
scalar wiretap codes over these channels, that are matched to 
the SNRs to Eve, {d 2 }, guarantees the secrecy of the scheme. 
Moreover, by using wiretap codes that work with respect to 
the SNRs to Bob of (l32b . the secrecy capacity is achieved. 
This is formally stated in the following theorem. 

Theorem 4. The layered-SIC scheme of Section m 
achieves the secrecy capacity under a covariance constraint 
C S (Hb,He K) by using: 

• The optimal input covariance matrix K of (122b . 

• Choosing Va of the SVD o/HeK 1 / 2 (135b . 

• Scalar Gaussian capacity-achieving wiretap codes that 
are designed for the Bob-Eve SNR-pairs { (& 2 — 1, d 2 ) }. 

Proof: The proof easily follows by noting that the result¬ 
ing channel to Eve is diagonal, i.e., parallel scalar AWGN 
channels. Hence, by using independent (wiretap) Gaussian 
codes, secrecy is guaranteed over the parallel channels. By 


combining the result of Section[IV]for SIC for MIMO channels 
without secrecy, correct decoding at Bob’s end is guaranteed. 

Codebook construction: Na Gaussian codebooks {Q k \k = 
1...., Na } of length n are generated independently, as 
in Definition [6] Codebook Q k contains [~2”' Rfc ] x 2"^ fc 
codewords. Each codeword within G k is assigned a unique 
index pair ( m,k,fk ), where m k £ {1,..., |"2 raflfc ] } and 
fk& jl,..., 2 n ^ k j. With a slight abuse of notation, we 
shall refer to such codes as wiretap Gaussian codes of rate- 
pairs 


Let e > 0. Then the rates are chosen a^| 

Rk = log 


bl 


1 + d? 


- 2e = log % - 2e, 


R k = log(l + d 2 k ) + e = log el + < 


(37a) 

(37b) 


Encoding (Alice): Constructs Na codewords {x k £ G k \k = 
1,..., ./Va} as follows. x k is chosen from G k according to the 
sub-message m k intended to Bob and a fictitious sub-message 
f k which is chosen uniformly at random. The transmitted 
signal at every time instant, x, is then constructed as in the 
layered-SIC scheme of Section HV1 

Decoding (Bob): Bob performs SIC decoding as in the 
layered-SIC scheme of Section HVl to recover {( m k , fk)}, and 
discards {fk}- Since R k + R k < log b\ for every k, the 
decoding error probability of Bob can be made arbitrarily 
small by taking a large enough n. 

Secrecy analysis (Eve): The resulting channel to Eve (l35l) 
(depicted also in Fig. [2bll is diagonal: 


y E = £> e x + z E , 


where ze is AWGN with zero mean and identity covariance 
matrix. That is, the effective channel to Eve comprises inde¬ 
pendent AWGN channels. Over the resulting scalar AWGN 
channels, wiretap Gaussian codes are known to attain strong 
secrecy ll42l . where R k is chosen to be (slightly) above the 
channel resolvability, i.e., R k = log(l + d 2 ) + e for e > 0. 
This is a stronger requirement, as opposed to the choice 
Rk = log(l + dl) — e for e > 0, which facilitates an easier 
proof of weak secrecy guarantees for this channel (see, e.g., 
03] Ch. 22]). 

Total rate: By using (l20b . (137ab . the total rate is equal to 


Na 

R = Y, Rk 

-£(- 4-* 

k=1 V e k 

= Is (Hb,He,K) — 2 N A e. 


By choosing the optimal K, and taking a large enough n, this 
rate can be made arbitrarily close to the secrecy capacity Cs 
while guaranteeing both weak and strong secrecy. ■ 

Remark 7. In the proofs to follow, with a slight abuse of 
notation, we shall state the sizes of the codebook without 


lJ To establish weak secrecy, R k can be relaxed to R k = log e| — e. The 
choice in l37bl allows to establish strong secrecy, as is further explained in 
the sequel. 
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explicitly using the ceiling operation [•], as its effect becomes 
negligible for large values of n. 

Remark 8. In the celebrated SVD-based scheme for MIMO 
channels of Telatar f20j], the SVD is applied to the physical 
channel matrix H = UDV^. The transmitted signal is then 
formed according to (f26t . where the non-unitary matrix K 1//2 
(over the effective diagonal channel D) is diagonal, with 
entries set by the water-filling solution. Thus, the SVD plays 
two roles: it serves both for reducing the coding task to that of 
coding over scalar channels and for constructing the optimal 
input covariance matrix. 

In contrast, in (135b the SVD is applied to the effective 
channel matrix II /■; K 1 ' /2 , which already includes the non- 
unitary “coloring” part K 1 / 2 . Thus, it is only used for reducing 
the coding task. This form is more general, in the sense that 
it allows for a choice of K that is not related to a diagonal 
decomposition of the channel, e.g., subject to individual power 
constraints, or where the target expression is different, e.g., an 
MI difference as in this work. Finally, note that the rate of 
m can be achieved using the proposed scheme, even if K is 
suboptimal (when exact calculation of the optimal K is hard). 

B. General Multi-Stream Scheme 

We next show that, in fact, secrecy capacity can be achieved 
using the layered-SIC scheme and scalar wiretap codes for any 
choice Va, and by this generalizing the result of Section IV-AI 
to transmission that is not necessarily orthogonal over Eve’s 
channel. Specifically, we show that the secrecy capacity can 
be achieved using any joint triangularization of the effective 
MMSE channel matrices (any unitary matrix Va at 

the encoder). In the general case. Eve’s resulting matrix is 
triangular and hence denoted by T E , as in (1 1 8bb . The diagonal 
values of T E are denoted by {e,}. The resulting family of 
schemes includes two important special cases, discussed in 
Section [V-CI in addition to the one introduced in Section IV-AI 

Theorem 5. The layered-SIC scheme of Section [7F1 
achieves the secrecy capacity under a covariance constraint 
Cs (Hb,He K) by using: 

• The optimal input covariance matrix K of (122b . 

• Any joint unitary triangularization ©. 

• Scalar Gaussian capacity-achieving wiretap codes 
that are designed for the Bob-Eve SNR-pairs 
{(6 2 — l,e 2 — l)}, where {bi} and {e,} are defined as 
in Section m 

We use the following result, proved in Appendix O for 
the proof of this theorem, which extends beyond the Gaussian 
wiretap setting, for both the discrete and the continuous cases. 

Proposition 1. Let p(y B \x) and p{y E \x) be the transition 
distributions for the legitimate user (“Bob ”) and the eaves¬ 
dropper (“Eve”), respectively, of a memoryless wiretap chan¬ 
nel, where x is the transmitted signal, and y B and y E are the 
channel outputs to Bob and Eve, respectively. Let a superposi¬ 
tion coding scheme be defined by codes {xi : i = 1,..., N A } 
and a scalar function tp such that 

x = ip{xi,... ,x N a ) . (38) 


Then, for e > 0, however small, and for any joint distribution 
p(x i,...,xjv a ), there exists a scheme which achieves weak 
secrecy, with the k-th codebook conveying a rate: 

Rk = J(xfc; y B ) - J(xfc; y E \x ^) - e. (39) 

Remark 9. The secrecy-proof of this result uses a “genie- 
aided” argument: in the mutual information of the /c-th code¬ 
word recovered by Eve, we provide all previous codewords 
{xg\ I = k + 1,...,N a } as “genie”, even though Eve 
cannot recover these messages. Bob, on the other hand, uses 
successive decoding to recover the messages. Thus, the allo¬ 
cation of rates {f?fc} in (139b guarantees that all the messages 
(mi,.. rriN A ) remain jointly secured from the eavesdropper’s 
channel output sequence. 

Proof of Theorem |5j We specialize the general su¬ 
perposition coding framework of Proposition |T] to the linear 
encoder structure and independent Gaussian distributions of 

(xi,... ,x N a ). Use 

x = ip(x i,..., x Na ) 

= K 1 / 2 Y A x, 


in ( l38l i. where the vector x is composed of one symbol from 
each codebook: x = (x \,..., 

Each codebook is a scalar Gaussian wiretap codebook of 
average unit power. The achievable secrecy rate of codebook 
k = 1,..., N a is given by ( l39b : 


Rk = I (xk', 


y b 


X Na )- I 
X k+ 1 ) 1 


(xfc! 


y e 


x N a ]-* 
x fc+i ) 


— I (xfcl y'B-k) ~ I (xfc! y E-k) - 
= log (bfc) - log (el) - e 
. b 2 k 

= bg -2 - e , 


(40a) 

(40b) 

(40c) 

(40d) 


where (140cb and (140bb are due to (13 lab and (13 1 cb . respectively. 
Thus, using the result of (l20b . we can achieve 


N 


1 b 'k 
bg -§ 


2 1 


R = Y, R k 

k= 1 
N 

= £ 

k =1 

= Is (H_b,He,K) , 


— e 


and for the optimal covariance matrix K the scheme ap¬ 
proaches the secrecy capacity. ■ 


C. Important Special Cases 

We now present “special” choices of which provide 
various advantages. 

1) Orthogonalizing Eve’s channel: The scheme of Sec¬ 
tion IV-AI is a special case of proposed scheme in this sub¬ 
section, since, as explained in Lemma [3] the unitary matrix 
V a of the SVD of H^K 1 / 2 is identical to that of the SVD of 

G E (fl8bb . 

10 Here, in contrast to Appendix Icl boldface letters represent spatial vectors 
and time indices are suppressed. 
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2) Orthogonalizing Bob’s channel — Avoiding SIC: Per¬ 
forming SIC adds complexity to the decoder, as well as 
introduces potential error propagation. We can avoid this by 
performing SVD with respect to Bob’s channel, as opposed to 
Eve’s channel, as done in Section IV-AI That is, choose Va 
such that 

G fl =U B D B v]i, 

where Dg is diagonal. As happens with Eve in Section IV-AI 
Bob obtains a diagonal equivalent channel, where each sub¬ 
stream can be decoded independently. 

3) Avoiding individual bit-loading: When using (non¬ 
secret) communication schemes based on SVD or QR, as in 
the layered-SIC scheme, the effective sub-channel gains {bi} 
are different in general. This requires, in turn, a bit-loading 
mechanism and the design of codes of different rates matching 
these gains. By using the GMD, described in Section III-AI 
instead, a constant diagonal is achieved, which translates 
into equal SNRs for all parallel channels. This suggests, in 
turn, that bit-loading can be avoided altogether and that the 
codewords sent over the resulting sub-channels can be drawn 
from the same codebook. 

A similar result can be achieved for the wiretap setting. 
To this end we require the usage of a modular scheme that 
transforms good AWGN codes of a rate close to log(6 2 ) 
for Bob into wiretap codes of rates close to {log(6 2 /e 2 )}. 
This way, after applying the GMD to Gg, the same AWGN 
codebook can be used over all sub-channels, where for each 
sub-channel a different transformation into a wiretap code is 
used, that depends on its effective SNR to Eve (e 2 —1). Indeed, 
such a modular approach exists; see Section IVlIIl 

Remark 10. It is possible to use the same wiretap code without 
assuming the modular wiretap code construction, by using a 
joint matrix decomposition that achieves constant diagonals for 
both triangular matrices simultaneously. A construction that 
essentially achieves this property was proposed in ll26l . 

VI. Dirty-Paper Coding Based Schemes 

In this section we construct the DPC counterparts of the 
layered-SIC scheme for Gaussian MIMO channels with and 
without secrecy constraints. In these variants the successive 
decoding process of the scalar codes is replaced with a 
successive encoding one; consequently, all (scalar) codebooks 
can be recovered in parallel and independently of each other. 
The latter makes these variants useful for more complex 
settings, such as the confidential MIMO broadcast setting 
treated in Section I VIII We start by presenting the DPC-based 
schemes without secrecy constraints, in Section IVI-AI We 
then construct a variant for the MIMO wiretap setting, in 
Section IVI-BI which again achieves the secrecy capacity of 
the channel. 

A. Without Secrecy Constraints 

We now briefly review the DPC variant of the layered-SIC 
scheme, which is based in turn on fl4l . B31 (see also HOlH . 


Scheme (Layered-DPC). 

Offline: 

• Select an admissible Na x Na input covariance matrix 
K that satisfies the input constraint. 

« Construct the effective MMSE matrix (IT71) : Gg = 
G(Hb, K). 

• Select a unitary triangularization (flTb and apply it to the 
matrix Gg, as in <EDl. to obtain the unitary matrices Us 
and Ya, and the generalized upper-triangular matrix T B . 

• Denote the Na diagonal elements of Tg by {bi}. 

• Denote by U B the Nb x Na upper-left sub-matrix of Us, 
and construct the corresponding matrix T b according to 
©: Tfl = U^HbK^Va. 

• Construct Na scalar dirty-paper codes l25l of length n — 
codes generated via random binning with respect to i.i.d. 
Gaussian distributions. Codebook * (1 < i < Na) is 
constructed for a channel with AWGN of unit power, 
SNR (6 2 — 1), interference [recall (l28l >l 

Na 

(41) 

l=i+l 

which is available as side information at the transmitter, 
and rate Ri close to log(6 2 ) [recall (l33l) l. 

Alice: At each time instant t = 1,... ,n: 

• Generates Xi from last (i = Na) to first (i = 1), where 
Xi is generated according to the message to be conveyed 
and the interference (l4lb . 

« Forms x with entries {x,}. 

« Attains the vector x by multiplying x by V.i and K 1 1 
as in (l34l >. 

« Transmits x. 

Bob: 

• At each time instant t = 1 , ... ,n, receives y B and forms 
y B according to (l29l) : 

Vb = U b Vb 
= Y b x + z B . 

« Decodes the codebooks using dirty-paper decoders, where 
Xi is decoded from ys;i- 

By using good dirty-paper codes, capacity is achieved; see, 
e.g., ED. 

We further note that codeword Xi is recovered from ys-i 
regardless of whether the other codewords {xj\j f *} were 
recovered or not. 

B. MIMO Wiretap Channel 

By replacing the dirty-paper scalar codes in the layered- 
DPC scheme of IVI-AI with scalar dirty-paper wiretap codes 
M, EH, a scheme that approaches the MIMO wiretap 
secrecy capacity can be constructed. 

Theorem 6. The layered-DPC scheme of Section I VI-A I 
achieves the secrecy capacity under a covariance constraint 
Cs(H b ,Hb K) by using: 

• The optimal input covariance matrix K of (1221) . 
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• Any joint unitary triangularization 

« Scalar Gaussian dirty-paper wiretap codes, where the i-th 
codebook (i = 1,..., Na) is designed for 

- Bob’s SNR of ( b\ — 1) and interference signal 
'Tht-iA i TB-,i,exe- 

- Eve’s SNR of (ef — 1). 

- Rate close to Ri = log (bf/ef). 


We next prove the existence of such codes and consequently 
also the result of Theorem [6] 

Proof: The proof follows by a standard extension of the 
proof of Theorem[5]to the dirty-paper case |[25l , ||46| , ||47| . 

Codebook construction: For each k = 1,..., Na, we gen¬ 
erate a codebook of 2 n ( Rk+Rk ^ sub-codebooks, where n is 
length of the codewords. Each such sub-codebook is assigned 
a unique index pair (rrik, fk), where rtik 6 {1,2,..., 2 nRk } 
and fk e {1, 2,..., 2 nRk }, and contains 2 n ^ Rk -(B k +R k )] 
codewords. Each codeword within codebook k is generated 
independently in an i.i.d. manner with respect to a Gaussian 
distribution p(u k ) with parameters dictated by 

Na 


U/C = + Oi k Yj f B .,k,tXt ) 

(42a) 

e=k +i 


a k A b l ~ 1 
bl ’ 

(42b) 


for zero mean unit power i.i.d. Gaussian random variables 
{x k \k = 1,.. .,N a }. 

Note that since in this case the interference (available as 
side information to Alice) in sub-channel k is composed of 
messages {xt\t = 1,..., N A }, the information carried by the 
sets = 1,..., N a } and {u^|£ = 1,..., Na} is the same. 

Let e > 0. Then the rates are chosen as 


R k = I (u fc ; y B ) - I (u k \ y e, uf+j) 

= /(u fc ;y B ) -/(u fc ;u^ - I (u fc ;y B - 
= I (xfc; y b * k +i) - 1 (*G y e 


-.Na \ _ 

^k+l) 


, bl 
log -f - e, 


R k = I [u k -y E u^) ~e = I (x k \ y E * k +i) 
= log el - e, 

R k - 1 K;ys) - e 

= log (b'l + \ T B;kA J - e- 
V e=k+i / 


— e 


(43a) 


(43b) 


(43c) 


Encoding (Alice): Encoding is carried in a successive 
manner, from last (k = Na) to first (k = 1). Within codebook 
k, the index of the sub-codebook to be used is determined 
by the secret message m k and a fictitious message f k drawn 
uniformly over their respective ranges. The codeword u k , 
within sub-codebook (m k , f k ) that is selected, is the one that 
is jointly typical with the side information Yl!t = k +i TB;k,e%e- 
If no such codeword u k exists, then the first codeword is 
selected. 


Decoding (Bob): Bob recovers (m k , f k ) using standard 
dirty-paper decoding as in Section [VI- Al and discards f k . The 
error probability can be made arbitrarily small by taking a 
large enough n. 

Secrecy analysis (Eve): As in the proof of Proposition [7] 
we provide {ue\£ = k+1,..., N a } as a genie for the secrecy 
analysis of u^,. By recalling that {x^|£ = k + 1,..., N a } and 
{ui\£ = k + 1 ,..., N a } carry the same information, and the 
linear relation in the definition of u k (142al >. the secrecy analysis 
reduces to the analysis in the proof of PropositionQ] as appears 
in Appendix [C] specialized to the Gaussian case. ■ 

VII. Confidential Broadcast as a Consequence 

In this section we consider the two-user MIMO confidential 
broadcast scenario. Namely, “Eve” is replaced with “Charlie” 
in ( l2bt . and the corresponding noise, output and channel 
matrix are denoted by z E , Uc an d He, respectively. 

We next show that, under the covariance matrix constraint, 
the rectangular capacity region ©, that was established in 
El, can be attained as a natural extension of the capacity 
derivation for the MIMO wiretap channel and the layered DPC 
scheme proposed in Sections [III] and [Vl] respectively. 

A. Capacity Region 

We saw in Section [HI] that in order to achieve the secrecy 
capacity where Charlie takes the role of Eve, the GSVD 
needs to be applied to (G B ,G c) and only the sub-channels 
corresponding to GSVs that are greater than 1 (corresponding 
to sub-channels with greater SNR to Bob than to Charlie) need 
to be used, and the rest — nullified. 

However, we note that, if we were interested in confidential 
communication with Charlie rather than with Bob, we would 
get the same solution with the roles of H B and He reversed. 
This, in turn, means inversion of the GSVs: 

log Ri (He, H B , K) = — log pi (H b , He, K). 

In these terms, we can write the rectangular capacity-region 
of the confidential broadcast channel ©, established first in 
ifTTI . as follows. 

Theorem 7. The capacity region of the confidential MIMO 
broadcast channel under an input covariance constraint K is 
given by all rates ( Rb,Rc ) satisfying: 

Na 

Rb<Y [ 1o § (Hb , He, K) ] + , (44a) 

2=1 
N a 

tfc<^[-log/^(HB,He,K)] + . (44b) 

2=1 

Remark 11. Similarly to the MIMO wiretap channel, the 
capacity region under a power constraint P is just the union 
of all (rectangular) regions under a covariance constraint with 
small enough trace. 

The converse part of this result is trivial by Theorem [3] 
since both users attain their individual secrecy capacities. For 
the direct part, it is tempting to think that since different 
GSVs are nullified for Bob and for Charlie, Alice can achieve 
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their optimal rates simultaneously by communicating over 
orthogonal “subspaces”. However, since the matrices T b and 
T c are not diagonal, these “subspaces” are not orthogonal, 
and some more care is needed. 

To this end, in the next section we put into force the layered- 
DPC scheme of Section EE which allows to recover the 
sub-message transmitted over each sub-channel independently, 
without the recovery of other sub-messages (in contrast to the 
layered-SIC scheme). This property is required by at least one 
of the users — Bob or Charlie — as each of them recovers only 
a subset of all the transmitted sub-messages. The derivation 
of the scheme thus provides a constructive proof for the direct 
part of Theorem [7] which is an alternative to the proof in CD. 

B. Capacity Achieving Schemes 

In view of Theorem [2] and the schemes developed for the 
MIMO wiretap channel, the result of Section [HI] has a rather 
intuitive interpretation: Va of the GSVD is the precoding 
matrix that designs the ratios between {&,} and {c^} to be 
as large as possible ({q} replacing {e^}), which corresponds 
to maximizing the achievable secrecy rate to Bob. In order 
to achieve Bob’s secrecy capacity, only the sub-channels for 
which the secrecy rate is positive (bi > a) need to be utilized. 
Allocating the remaining sub-channels to Charlie, on the other 
hand, attains Charlie’s optimal covariance matrix. 

Combining the two gives rise to the following scheme, 
which is a straightforward adaptation of the layered-DPC 
scheme of Section [VI] for the wiretap channel. 

Scheme (Confidential broadcast via layered-DPC). 

Offline: 

• Construct the effective MMSE matrix ( fT71 >: G b — 
G(H b ,K) and G c = G(H C ,K), where K is the 
constraining matrix. 

• Apply the triangular form of the GSVD (fl6b to 
(G b ,Gc) as in <[25]», to obtain the unitary matrices 
U b, U c and Va, and the generalized upper-triangular 
matrices T B and Tc- 

• Denote the diagonal elements of T B and of Tc by { b t } 
and {cj}, respectively. 

• Denote further the (first) number of indices for which 
bi > Ci by Lb- The remaining Lc = Na — Lb indices 
satisfy c* > bi. 

• Denote by U B the upper-left Nb x Lb sub-matrix of U n, 
and by Uc — the upper-right Nc x Lc sub-matrix of 

U c- 

• Construct T B and Tc as in (f27l ): 

T B = UbHbK^Va , 

Tc = U^HcK 1 / 2 ^ ■ 

• Construct Na good scalar dirty-paper wiretap codes of 
unit power and length n, denoted by {xi\i = 1,..., TV^} 
(with the time index omitted to simplify notation), gen¬ 
erated via random binning with respect to i.i.d. Gaussian 
distributions, as follows. 

- The first Lb codes are intended for Bob: Codebook 
Xi (1 < i < Lb) of a rate close to R t = log (h 2 /c 2 ) 


is constructed for an AWGN channel to Bob of SNR 
hf — 1, and interference: 

N a 

T B -i,exe , 

e=i +i 

and for an AWGN channel to Charlie of SNR c 2 — 1. 

- The remaining Lc codes are intended for Charlie: 
Codebook Xi {Lb + 1 < i < Na) of a rate close 
to Rt = log (c 2 /& 2 ) is constructed for an AWGN 
channel to Charlie of SNR cf — 1 and interference: 

Na 

Tc-i/xe , 

e-i+i 

and for an AWGN channel to Bob of SNR 6 2 — 1. 
Alice: At each time instant t = 1,..., n: 

• Generates Xi from last (i = Na) to first (i = 1), where 
Xi is generated according to the message to be conveyed 
and the signals {xt\i = i + 1,..., Na}. 

• Forms x with entries (,x',}. 

• Attains the vector x by multiplying x by Ya and K 1//2 
as in (l34l >. 

• Transmits x. 

Bob: 

• At each time instant t = 1 ,,n, receives y B and forms 
y B according to ( l29t : 

Vb = 

= T b x + z B . 

m Decodes codebooks i = 1,...,Lb using dirty-paper 
decoders, where x t is decoded from yu-r- 

Charlie: 

• At each time instant forms 

Vc = U cVc 
= T c x + z c . 

• Decodes codebooks i = Lb + 1,..., Na using dirty- 
paper decoders, where Xi is decoded from yc-,(i-L B )■ 

The following theorem proves that this scheme allows both 
users to attain their respective secrecy capacities simultane¬ 
ously ., providing a proof for Theorem [7] 

Theorem 8. The layered-DPC confidential broadcast scheme 
achieves the secrecy capacity region under a covariance 
constraint d44]l by: 

• Using scalar Gaussian dirty-paper wiretap codes in¬ 
tended for Bob, as follows, where the i-th codebook 
(i = 1 ,... ,Lb) is designed for: 

- Bob’s SNR of (& 2 — 1) and interference signal 
Efci+l TB-i/Xt. 

- Charlie’s SNR of (c 2 — 1). 

- Rate close to Ri = log(6 2 /cf). 

• Using scalar Gaussian DPC wiretap codes intended for 
Charlie, as follows, where the i-th codebook (i = Ls + 
1,..., Na) is designed for: 
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- Charlie’s SNR of (cf — 1) and interference 

El A l+ iT C ^xe. 

- Bob’s SNR 0 /( 6 ? - 1). 

- Rate close to Ri = log (c?/6?). 

Proof sketch: We start by noting that since the capacity 
region is rectangular, it suffices to show how to approach the 
corner point of this region. The proof relies on the fact that 
in the layered-DPC scheme for the MIMO wiretap channel 
of Section 1 VII each sub-codebook is recovered independently, 
regardless of the other sub-codebooks. Hence, the proof of the 
decodability and secrecy analysis for Charlie are the same as 
in the proof of Theorem[ 6 ](with Charlie being the “legitimate” 
user). In the treatment for Bob, a small variation is needed: 
the interference over sub-channel i (1 < i < Lb) is composed 
of both, messages intended for Charlie, x^b+v an d messages 
intended for Bob, x^P. Thus, the DPC for Bob is carried with 
respect to both of these interferences, and the decodability and 
secrecy analysis follow as in the proof of Theorem [ 6 ] ■ 

Remark 12 (Replacing DPC with SIC). DPC was used in the 
layered-DPC scheme for both users. However, in the proposed 
scheme one may use SIC instead of DPC for Charlie, as 
is done in the layered-SIC scheme for the MIMO wiretap 
problem. Alternatively, by using lower-triangular matrices 
instead of upper-triangular ones in dT 8 b (which corresponds to 
switching roles between Bob and Charlie in the construction 
of the scheme), one can use SIC for Bob and DPC for Charlie. 
This phenomenon was also observed by Liu et al. DU- 
Unfortunately, this scheme does not allow, in general, to avoid 
DPC for both of the users. 

Remark 13 (Other choices of precoding matrices). In Sec¬ 
tion IV-CI different choices of Va were proposed for the 
MIMO wiretap problem: diagonalizing either I’ n or Tc, 
which corresponds to avoiding SIC by Bob or guaranteeing 
strong secrecy, respectively; or, by balancing all the SNRs 
of the sub-channels to Bob, which allows using the same 
codebook over all sub-channels and avoiding bit-loading / rate 
allocation. The analog in the case of confidential broadcast can 
be achieved by applying block diagonal unitary operations, in 
addition to the matrix \a that is dictated by the GSVD, where 
the blocks correspond to the sub-channels that are allocated to 
Bob and to Charlie, of dimensions Lb x Lb and Lc x Lc, 
respectively. However, whereas we can avoid SIC and DPC 
at Bob’s end in the layered confidential broadcast scheme by 
diagonalizing his channel, we cannot achieve this result for 
both Charlie and Bob simultaneously, as DPC needs to be 
employed for at least one of the users. 

VIII. Discussion: From Random Ensembles to 
Specific Codes 

In this work, we have demonstrated how scalar codes can 
be used for some MIMO secrecy scenarios. Throughout the 
work, we have assumed that these scalar codes are taken 
from a random Gaussian ensemble, suitable in an appropriate 
sense (with or without secrecy constraints, with or without side 
information). One may be interested in a stronger result, where 
any scalar codes that are good in the appropriate sense can 


be used, without worrying about the way they were created. 
Further, it is desirable to construct MIMO secrecy schemes 
using any standard (non-secrecy) scalar codes that are good 
for communication over the (non-secrecy) AWGN channel. 
To that end, one may hope to combine the approach of the 
current work with procedures that construct scalar wiretap 
codes from non-secrecy ones, such as m (which is based 
upon similar techniques for discrete wiretap channels proposed 
in l48l . 1491 ). Unfortunately, as we report in 1150) , there are 
some obstacles. 

Surprisingly, the problem lies already in the use of scalar 
codes for MIMO communications without secrecy constraints. 
Recall the V-BLAST/GDFE schemes presented in Section [IV] 
and depicted in Fig. [Q Such schemes are widely accepted 
in the literature as capacity achieving, without proposing 
any treatment or analysis for specific codes. In practice, 
such schemes are used in conjunction with arbitrary scalar 
codebooks, e.g., one-dimensional constellations with some 
error-correction code |27); however, the combination does not 
necessarily approach capacity even if the individual codes do. 
Indeed, for some specific channel matrices, the scheme might 
perform very poorly. To see this, consider ®. This is a 
multiple-access channel (MAC) from the inputs x i,..., Xi to 
the output The SIC decoder treating all inputs as noise is 
equivalent to a stage of a successive-decoding procedure for 
the MAC. For the MAC, in turn, not any collection of good 
AWGN codes achieves capacity (see, e.g., ED). For example, 
assume that a MAC is given by 

Ub = xi + x 2 + z. 

Now further assume that the two codebooks are nested lattices. 
In that case (up to shaping), any possible point of x\ + X 2 is 
also a point of the higher-rate code, thus one codebook cannot 
be decoded without the other. The problem is not restricted to 
integer coefficient ratios but affects performance for coeffi¬ 
cients close to any “simple” ratio; see, e.g., f52l Section III]. 

Returning back to the multi-stream schemes for the MIMO 
wiretap setup of Section [Vj the decoder of Bob will also 
incur the same difficulty discussed above when generalizing 
to arbitrary scalar codes. Furthermore, the same issue arises 
in our secrecy analyses (except when Eve’s channel is or- 
thogonalized, as in Section IV-Al l: We successively provide 
Eve with previous messages as a “genie” side information. 
As a result the proof hinges on Eve’s disability to perform 
a successive decoding process in the presence of interference 
from yet undecoded messages. Here also this interference is 
taken to be Gaussian and alignment might help Eve. 

To conclude, of the two ingredients needed for adjusting 
any codes that are good for communication over scalar AWGN 
channels to the MIMO wiretap channel, the secrecy part can 
be treated by the procedure of lfl2l . The remaining problem is 
similar to the one in SIC without secrecy constraints. Indeed, 
obtaining good scalar Gaussian codes that approach capacity 
under SIC (without secrecy) from arbitrary scalar Gaussian 
codes remains an interesting open problem. 
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Appendix A 
Proof of LemmaQ] 

The following proposition will be used in the proof of 
Lemma [T| 

Proposition 2. Let Ai and A 2 be m\ x n and m 2 x n full-rank 
matrices, respectively, where TOi > n and m 2 > n. Consider 
the generalized eigenvalue (GEV) problem: 

A{Aiy = AA-j,A 2 y. 

Then, the generalized eigenvalues of (A{Aj, A 9 A 2 ), {Ai}, 
are the GSVs of (Ai, A 2 ), {gti\, and the generalized eigen¬ 
vectors are the corresponding columns of 

Y = X _t . 


Furthermore, the differential of the GEV A in terms of the 
differentials of A{Ai and of AtA 2 is given by 


dX = 


yt^AjAO-AdtA^Aa^y 

yt A} Aiy 


(45) 


Proof: The first part of the proposition easily follows from 


G^G S Y = XD|, 
G^GbY = XD|. 


The proof of the differential identity (195) can be derived by 
standard eigenvalue perturbation analysis; see, e.g., |53| . ■ 


Consider now the diagonal variant of the GSVD of Gg = 
G(H B ,K) and G E = G(H B ,K) <d: 

G B =U B D B Xt, (46a) 

G B = U B D B Xt, (46b) 


and denote the squared GSV vector by A, i.e., the vector whose 
entries satisfy: 

A* — di ■ 

Note further that 0 < //.», Ai < 00 , since G B and G/.; are of 
full rank [recall (fTTIi I. 

Following d20b . the MI difference in terms of {Ai} is equal 
to 

/ s (H B ,H B ,K) = ^logA I . 

By applying the result of Proposition [2] to the effective 
channel matrices of (l46t . we obtain the following lemma. 

Lemma 4. The differential of the GSV A, (i = 1, , Na), in 
terms of the differential of the covariance matrix K, is given by 

efdXi = (Ai — l)yjB _ 1 (dK)B _ ^y i , 

where B = K 1//2 , e is the diagonal of D B , and y i is the 
corresponding generalized eigenvector corresponding to A B 

Proof: Perturbing K results in the following differentials 
of GjgG B and G^G B 06) : 

2d(G]gG B ) = B- 1 (dK)H^H B B + B t H^H s (riK)B - ^, 

(47a) 


2d(G^G B ) = B _ 1 (<iK)H^H B B + B t H^H B (dK)B _t . 

(47b) 


Substimting (147) in (145) . gives rise to 

2e 2 dAi = y\ ^B _ 1 ((IK)(H^H S - A,;H^H b )B 

+ Bt(H^H B -AiH^H B )(dK)B-t) yi 
= y\ (B- 1 (dK)B-tBt(H^H B - AiH^H B )B 

+ Bt(H^H B - A i H^H B )BB' 1 (dK)B^^ ?/? 
= 2(Ai-l)y|B- 1 (dK)B-t 2/?; , 


as desired. ■ 

Corollary 1. If (IK is positive semidefinite, then the sign of 
d\i equals the sign of Ai — 1 . 

The result of Lemma [T| follows immediately from this 
corollary. 


Appendix B 

Truncation of Generalized Singular Values 
Apply the triangular variant of the GSVD (IT 6 ) to the 
matrices G B = G(H B ,K) and G B = G(H B ,K), as in ([XT) 
and (ITS) : 

G b 4 | H ^ 1/2 j = UbDbTVJ, , (48a) 

G b ^ = U b D b TV^ . (48b) 

Using any unitary matrix Q instead of I in the definition of 
G b and Ge, has no effect on the resulting matrices V,4 , T, 
D b and D b : 

( H f /2 ) = uIDbTV^ , 

( H f /2 ) = U^D B TV^. 

Furthermore, the upper-left 7V B x Na and fV B x N E of the 
resulting left unitary matrices U^, and U^, respectively, are 
equal to those of U B and U B of (148} . 

Using the last observation with Q = v\ and 08} for the 
matrices 

gs*(h-k^_^.k 

gives rise to the GSVD of G^ and G^: 

G b — U b D b T , (49a) 

G^ — U b D b T , (49b) 

where U)i and U B are unitary (and their 7V B x Na and N E x 
Na upper-left sub-matrices are equal to those of U B and U B , 
respectively). 

That is, the GSVD of G^ and G^, is achieved by applying 
a QR decomposition to each of them. 
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The representation in ( l49l ) allows us to incorporate a trun¬ 
cation operation: 

G ' b A (KbK^VaIb^ 

= V' b T>' b T' (50a) 

g , e a 

= U' B D' B T' , (50b) 

where and are unitary having the same first L B 
columns as U B and U B , respectively; T', D' s and T)' E have 
the same first L B columns as T, T> B and D B , respectively, 
whereas the remaining L E = Na — L B columns are all zero 
except for the diagonal elements, which are equal to 1: 

= D E-i,j = T ij = !> i= j,j > L b ; 

=0, i / j, j > Lb ■ 

The latter is easily seen by noting that the QR decomposition 
carries out a Gram-Schmidt process over the columns of 
the decomposed matrices, and hence the first L B columns 
remain the same after applying l B , whereas the structure of 
the remaining columns is trivial due to the nullification of the 
last L b columns of HbK 1 ^ 2 V j 4 - 

We note that (l50l > is the GSVD of G' B and G' E up to the 
normalization property (fl5l >. which has no effect on the GSVs 
and can be achieved by a multiplication by an Na x Na 
diagonal matrix with its first Lb entries equal to 1 and the 
remaining entries — to l/-\/2. 

The desired result is established by noting that K 1 = 

K^V^Ib, and that the first Lb GSVs of (G' B , G^) are equal 
to the first Lb GSVs of (G B , G E ) (the GSVs that are greater 
than 1) and the remaining GSVs of G^) are equal to 1. 

Appendix C 

Proof of Proposition!]] 

In this appendix, with a slight abuse of notation, we denote 
by boldface letters n-length sequences, with n being the block 
length (in contrast to the other parts of the paper, where 
boldface letters denote spatial vectors). 

Proof of Proposition [7} Denote 

i? fc = /(x fc ; yslx^-e. (51) 

The codebooks are generated sequentially, from last (k = 
Na) to first (k = 1), as follows. For k = Na, construct 
the codebook Gn a of 2 h ( Rna+Rna ') codewords, that are 
generated independently with i.i.d. entries with respect to 
p(*n a )- F° r h £ {1,..., Na — 1}, for each (already gen¬ 
erated) codeword set (x k +i, ■ ■ ■, xn a ) G Cfc+i x • • • x Cn a , 
generate a codebook of 2 n ( Rk+Rk ^ codewords with re¬ 
spect to rn ! =iP(*fcl 5 fc+i(*)> ■ • ■ ,x Na {i)), where x e (i) is the 
*-the letter of the codeword x E Within each codebook, 
each codeword is assigned a unique index pair ( m k ,f k ) 
where m h G {1, 2,..., 2 nRk } and f k G {1, 2,..., 2 nRk }. 
Each codeword is selected according to the secret mes¬ 
sage m k and a fictitious message f k drawn uniformly 
over its range. The transmitted codeword is therefore 


x = ip (aii (mi, fi),x NA (m NA ,f NA )). Bob’s decoding is 
based on successive decoding starting from the last message 
(k = Na) and proceeding to the first (k = 1). 

Since 

R k + Rk= I (x fc ; y B S&) - 2e (52a) 

< I (x fc ;y B , (52b) 

the decoding of each combined message ( m k ,f k ) succeeds 
with arbitrarily high probability, as n —> oo. 

In order to satisfy the secrecy constraint, the following 
condition must hold, for any e > 0 and large enough n: 

-H (mi,.. .,m NA \y E , 6) > -H(m i,... ,m NA ) - e, 
n n 

where C = {C|,..., } denotes the overall collection of 

the Na codebooks. 

It suffices to show that for any e' > 0, and large enough n, 

^H(m k \y E , m^e) > ^ H(m k ) - e' 

is satisfied for each k. 

Note that 


H ( rn k 


y E , m k+i; e ) > H (j 


Vei *fc+i> 


= H 


( m k ,x k -H (x k m k , y E , x k A x , e) 


= H (x k 


~ N a 
VE^k+1 


e)-H (/* 


mk,y E ^k+i’ e ) ■ 


Due to d5lt . in our construction the eavesdropper can decode 
f k with probability going to 1, given (m k ,y E , x k A 1: e). and 
hence the second term is vanishingly small. Thus, we are left 
with 


H (m k y E , mj^e) > H (x k 


- Na 
VE,X k +1 


e -■ 


= H 


(x\ -h(x\ 1 x^ A ,y E ,e^j -ne 


/ 

n • 


Since the two equivocations are the same quantity up to an 
index shift, it suffices to show that for <5i > 0 and 62 > 0 that 
vanish with e and large enough n, 




K 

l 1 fays 

' L 

\ H (*1 ^k+l^E^) 


1=1 

< 


(xr; 


Y e 


x t+i) 


-61 


< 


e=i 


ys 


&)- 


(xe; 


yE 


-n a \ 
V+i ) 


+ 82 ■ 


(53a) 

(53b) 

(53c) 


To establish (153bl) we use the fact that the sequences xi are 
selected independently given x^ A x , so that, for large enough 
n, the following chain of inequalities holds 


H 


(*1 ^k+i^y E ^) 

[x\ * fe +i,e) - I (x\;y E x^^ ,c) 


= H[x1 


E [H (xe 

t= 1 


®i+i,e) -1 (xt;y E 


-„Na 




(54a) 

(54b) 

(54c) 
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K 

Y [ nI (**■< 


y b 


t=i 


<m)"2 e-I 


(ft, 


Ve 


z,Na p 


K 

> nY [ 7 (* f; *«+i) ~ 1 (*«;y® *i+i) 


- 3e 


e=i 


(54d) 


(54e) 


where (154dl > follows from (152ab . and to establish (154el > we use 
the fact that the channel is memoryless along with standard 
typicality arguments El. 

To establish ( 153cb . we use [f55l Lemma 1], by substituting: 


• S = Y( R e + Y) 

i= l v 

• v = xj 

•i = (mf,/f)e[ l,2" s ] 


• u = x 


n a 

fc+i 


• z = y E 


The conditions for the lemma hold since 


H 


(x{ 


xf+i.yB.e) = H i 


5 )="( 


L 


*k+i>yE> c 


)■ 


and 


k 

S = Y( R e + R e) 

t=i v 
k 


> 




y b 


u=i 


= I 


(*!; 


y^ 


;y_E 


-,n a 

st+i 


-N a \ 

H+i J 


~Na 

V+i 


- 2e 


(55a) 

(55b) 

(55c) 

(55d) 


where (I55cb follows from the fact that the communication rate 
lit of each sub-channel must be positive (and e and S are small 
enough, and n is sufficiently large), else it is not used. Since 
we have proved (153bb and ( I53cb . the secrecy analysis is now 
complete. ■ 


Remark 14. For the special case of mutually independent 
(xi,...,Xiv A ), there is no need to generate a different 
codebook Gk for each selection of preceding codewords 
(xk+i, ■ ■ ■ ,xn a ), and the same codebook can be applied 
regardless of the other codewords. 
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